Introduction to Firewall in Linux-Based Systems - Essay Example

Firewall in Linux of In this paper, we will have a short introduction to firewall in Linux based systems. We will discuss the way we can use IP Tables to set firewall rules in Linux environment and we will aim to an IP Table firewall definition for a system that requires some special settings. We will apply these rules to Linux Firewall and we will discuss how these rules impact the system. For more convenience and more security in the system, we will also make the rest of the rules as security focused (and sensible) as possible. Introduction "iptables" is Linux firewall which has been a part of the kernel since version 2.4. It is often referred to as a packet filter as it examines each packet transferred in every network connection to, from, and within your computer. iptables replaced ipchains in the 2.4 kernel and added many new features including connection tracking (also known as stateful packet filtering).1 In this article we will use iptables to build a simple but effective firewall for the following scenarios: - Full egress and ingress filtering. - The machine has only one network connection, eth0. - The machine runs ssh, telnet, apache, and qmail. - It should be able to surf the web, send email and make DNS lookups. - The apache user should not be allowed to surf the web. 1. Full egress and ingress filtering. In order to implement this condition, we have to add these simple rules at the beginning of the filtering rules: INPUT DROP [0:0] FORWARD DROP [0:0] OUTPUT DROP [0:0] This means that the configuration for the firewall is set to "deny all connections" by default and the only way to establish connections between to point or two entity, we have to explicitly add new rules for them. The term "INPUT" refers to any packet that is coming to this computer, "OUTPUT" means any packet that is generated by this computer and is leaving it. The term "FORWARD" also means the packets that are arriving from another computer but their final destination is one other computer. In fact we have used this computer to transit the packets between two different computers. The term "DROP" means that "the packet is not allowed through the firewall and the sender of the packet is not notified."2 2. The machine has only one network connection and it should be able to surf the web, send email and make DNS lookups. In our firewall rule set, as you have seen above in section one, all incoming and outgoing packets are dropped unless we add new rules that allow our system to deal with. We have only allowed the system to use one connection by defining only one connection named "eth0" in the rules as follows: # allow connections to my DNS servers -A OUTPUT -d 2.3.4.11 -m state --state NEW -p udp --dport 53 -o eth0 -j ACCEPT # allow outgoing connections to web servers -A OUTPUT -d 0/0 -m state --state NEW -p tcp --dport http -o eth0 -j ACCEPT -A OUTPUT -m state --state NEW -p tcp --dport https -o eth0 -j ACCEPT # allow outgoing mail connections to my ISP's SMTP and POP3 server only -A OUTPUT -d 2.3.4.5 -m state --state NEW -p tcp --dport smtp -o eth0 -j ACCEPT -A OUTPUT -d 2.3.4.5 -m state --state NEW -p tcp --dport pop3 -o eth0 -j ACCEPT As you can see, the rules above, allows the system for DNS access, allows to access to the web pages (http) and secure web pages (https). 3. The machine runs ssh and telnet. In order to add to add these rules we need to add the following lines to our firewall rule: # The machine runs SSH and TTELNET -A INPUT -i $EXTIF -p tcp --dport 22 -j TCPACCEPT -A INPUT -i $EXTIF -p tcp --dport 23 -j TCPACCEPT 4. The apache user, should not be allowed to surf the web. # Do not allow incoming outgoing connections to web servers for apache (2.3.4.6) -A INPUT -d 2.3.4.6 -m state --state NEW -p tcp --dport http -o eth0 -j REJECT -A INPUT 2.3.4.6 -m state --state NEW -p tcp --dport https -o eth0 -j REJECT -A OUTPUT -d 2.3.4.6 -m state --state NEW -p tcp --dport http -o eth0 -j REGECT -A OUTPUT 2.3.4.6 -m state --state NEW -p tcp --dport https -o eth0 -j REJECT The lines above, states that any input and output packet for the use named apache with IP address 2.3.4.6 for both regular web pages (http) and secure web pages (https) is restricted. Considering the above conditions, the final firewall script would be like this: 1 *filter 2 :INPUT DROP [0:0] 3 :FORWARD DROP [0:0] 4 :OUTPUT DROP [0:0] 5 6 # allow local loopback connections 7 -A INPUT -i lo -j ACCEPT 8 9 # drop INVALID connections 10 -A INPUT -m state --state INVALID -j DROP 11 -A OUTPUT -m state --state INVALID -j DROP 12 -A FORWARD -m state --state INVALID -j DROP 13 14 # allow all established and related 15 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 16 -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 17 18 # allow connections to my ISP's DNS servers 19 -A OUTPUT -d 2.3.4.10 -m state --state NEW -p udp --dport 53 -o eth0 -j ACCEPT 20 -A OUTPUT -d 2.3.4.11 -m state --state NEW -p udp --dport 53 -o eth0 -j ACCEPT 21 22 # allow outgoing connections to web servers 23 -A OUTPUT -d 0/0 -m state --state NEW -p tcp --dport http -o eth0 -j ACCEPT 24 -A OUTPUT -m state --state NEW -p tcp --dport https -o eth0 -j ACCEPT 25 26 # allow outgoing mail connections to my ISP's SMTP and POP3 server only 27 -A OUTPUT -d 2.3.4.5 -m state --state NEW -p tcp --dport smtp -o eth0 -j ACCEPT 28 -A OUTPUT -d 2.3.4.5 -m state --state NEW -p tcp --dport pop3 -o eth0 -j ACCEPT 29 30 # Do not allow incoming outgoing connections to web servers for apache (2.3.4.6) 31 -A INPUT -d 2.3.4.6 -m state --state NEW -p tcp --dport http -o eth0 -j REJECT 32 -A INPUT 2.3.4.6 -m state --state NEW -p tcp --dport https -o eth0 -j REJECT 33 -A OUTPUT -d 2.3.4.6 -m state --state NEW -p tcp --dport http -o eth0 -j REGECT 34 -A OUTPUT 2.3.4.6 -m state --state NEW -p tcp --dport https -o eth0 -j REJECT 35 36 # The machine runs SSH and TTELNET 37 -A INPUT -i $EXTIF -p tcp --dport 22 -j TCPACCEPT 38 -A INPUT -i $EXTIF -p tcp --dport 23 -j TCPACCEPT 39 40 41 # log all other attempted out going connections 42 -A OUTPUT -o eth0 -j LOG 43 # default is to DROP out-going connections 44 45 COMMIT The above set of firewall rules are best for a home computer which uses the Linux. More additional rules are added for more security. References Barry O'Donovan, Firewalling with netfilter / iptables , june 2004, from linuxgazette.net, INTERNET Read More